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MEMORANDUM FOR THE RECORD 


SUBJECT: The APEX Special Access Control System: 
A Security Manual for Industry; control] of 


1. As part of the learning phase for the Industrial Contracting/ 
Industrial Security Team, [__—_} Special Assistant to the DCI 
for Compartmentation, briefed us on he proposed new security system. — 
He emphasized the sensitivity of the program and the fact that it 

was still in staffing. Accordingly, no disclosure of the infor- 
mation provided would be permitted. 


2. On 13 June 1979, as part of aL _________]survey of 25X1 
contractors,L_____________]and I inspected the 


rogram Security Officer, stated that "the new system 
would g them problems with the two person rule plus other 
rictions." He indicated that he had the manual and that Mr. 
had been briefed on it. I neither confirmed nor denied the 
existence of the manual but rather turned the discussion to other 
matters. 


3. Upon return toL_____ office, he put a xerox draft 
copy of subject manual on the table. I inspected itand noted 
several comments in the margins indicating both a close perusal 


by as well as substantial dissatisfaction on his part 

with the two-man rule and other requirements of the APEX system. 

He volunteered the information thatL_______ (Security Officer 25X14 
for the had sent the draft xeroxed manual to him. 

He opined that "now he had gotten[____Jin trouble." I again did 5X1 


not continue the discussion--which he clearly wanted to do--but 
turned to a discussion of document control and other subjects of 


concern to us. 


4. Upon return to Headquarters at 0820, 21 June 1979, I 
advised the Deputy Inspector General of the situation, asked him 
to brief the Inspector General and suggested that I adviseL__] 25X1 
[____] about the disclosure of the APEX Manual. He agreed and I 
subsequently briefed Mr..-___] He will discuss the situation with 


Us. o-1536 


rn 
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DCI Security. I noted that I would do nothing further unless 
otherwise directed by my superiors and left the matter in his 
hands. 


25X1 


Distribution: 


25X1 Mr. 
; Mr. 


D/S . 
C/SS/OD&E 
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INDUSTRIAL SECURITY BRANCH COMMENTS 
— EE EE EE SU IMENTS 


APEX CONTROL SYSTEM MANUAL 


GENERAL COMMENTS 


1. Inasmuch as the APEX Control Manual sets forth policy 
Standards and procedures to protect Sensitive Compartmented 
Information, it is recommended that the manual itself be 
Classified since it, in itself, is an intelligence method. 

If it is not classified, it will be available to anyone 
under the Freedom of Information Act. 


2. It should be recognized that if the 1973 USIB Standards 
for setting forth the physical security requirements for the 
protection of Sensitive Compartmented Information are utilized 
as intended for the protection of Sensitive Compartmented 
Information controlled by the APEX Security Control System, 
then that protection is weak and is not compatible with the 
Statement in Section 2 of the APEX Control System Manual, which 
States that EO 12065 recognized the need to establish special 
access programs to control access, distribution, and protection 
of particularly sensitive classified information, etc. 


SPECIFIC COMMENTS 


Cover Memorandum dated -Paragraph 7 of this memorandum 
25X14 26 January 1979 from indicates that guidance regarding 
25X4 Sections VII e, £, and g would not. 

be part of the Manual. We have 
included comments on these items 
(changes in personal status, 
contacts or association with 
foreign nationals, alien marriages 
and travel and duty assignment 
restrictions) in our drafts of the 
Industrial Security Manuals. For 
the sake of uniformity, should the 
Government manual not also include 
such instructions? 
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Page 1, last line -Suggest the insertion of the a 
word "control" between "individual" 
and "system." 


Page 4, line 1 -Suggest this sentence begin as 
follows: '"In order to protect 
highly..." etc. 

Page 5, line 5 ~Suggest the phrase "within 30 days" 
be replaced by the phrase "30 days 
before." 

Page 10, first four -Will there be any written evidence 

paragraphs in the security files of an 


individual which attests to the 
operational or product compartments 
within the Apex Control System, 

to which he had had access? 


Page 10, paragraph C -Do the words "as appropriate" 

. modify the persons named in the 
first sentence, or do they modify .< 
the whole statement in the first we 
sentence, so that annual 
rejustification would not be 
required until that were considered 
appropriate? 


Page 13, paragraph i -Shouldn't these individuals be 
; bound by an Apex Secrecy Agreement? 
If not, there are no limitations 
on these individuals not to 
disclose Apex Control Information. 


Page 14, paragraph VI b -Since this is such sensitive 
information, would it not be a 
good idea to limit the knowledge, 
v even within the Central Access 
“~ Approval Registry, of the names of 
the people who are accessed to 
data? 25 


Approved For Release 2004/05/12 : CIA-RDP85T00788R000100060011-6 


ig é 
. \ 
; : Approved For Release 2004/05/12 : CIA-RDP85-T00788R000100060011-6 


r 


Page 15, lines 2, 3, and 4 -Should not this sentence read, 
"Status, rank, and position are 
not in themselves sufficient reasons 
to establish the clearly demonstrated 


needs to see data?" 25 
Page 15, Section c, second -Should not the Two-Person Rule 
paragraph be exercised when it is necessary 


to Sere Me eee 4h 25 
outside the control office” it 
area? If not, an individual oe 
would have the opportunity to 

copy this very sensitive information 


if he chose to. 


Page 16, first paragraph -Will [____]material be open-shelf 25 
stored or should it not be always \ 
secured in a GSA-approved security oe 
container or in a drawer with a. ee 
separate control drawer head in. 

a GSA- approved security containe &: 
ea ONAN RS RENE GEE 

Page 17, paragraph VII a.1 -DCID 1/19 is is appropriate as far as 

= it goes. But is doesn't include the 
Two-Person Rule and other various 
items. It could, or course, be 
amended to include them. 


Jay 


Ae 
wakeee’ 


Page 18, Paragraph VII b.5 -This paragraph requires rebtiefing 
on at least a bi-annual basis, 
The DCI and Director of Security 
have asked for annual rebriefings, , 
at least in industry. Is this : 
consistent with their me cde 
Page 19, line 10 -What is a ‘fimely basis? The ae 
with CIB records now is that they 
are always out of date. 


Page 20, line 8 -Same comment as on page 16, first 
paragraph. 
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Page 20, paragraph 6 ~See comment regarding page LS, 
Section c, second paragraph. 


Page 23, Section c ~Suggest first sentence begin as 
follows: "Security approval for 
access to..." 


“Suggest the title of DCID 1/14 
be capitalized, since it is a 
formal title. 


Page 23, Section d, lines 6 ~Suggest phrase "for inclusion in the 
and 7 Central APEX Registry" be changed 
to read "in order to update the 
information maintained in the 
Central APEX Registry." 


Page 24, Section e -This section does not make it 
Clear that casual contacts with 
hostile country nationals should _ 
or should not be reported. Should. 
they? What is a casual contact? 


-Also, since Section VII e, f, and 
Will apparently not be in the APEX 
Manual, where will they appear? 
Will each Agency issue its own 
instructions or will these be a 
Uniform sect of instructions issued 


by SECOM? 


Page 25, line 4 -Suggest the phrase “are accessed" be 
struck and replaced with the phrase 
"who have been approved and briefed 
for access..." 


Pages 32 and 33, section c -The common badge system appears to 

be a poor method to be utilized for 
establishing prima facie evidence 
of the approval status of an 

\ individual's access to various APEX 

compartments. It seems that it 
would be difficult to keep this 
badge up to date and problems would 
be encountered in attempting to 
continuously revalidate the badges. 
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Page 41, Section c, line 3 .-Will the two couriers be required to 
~ be approved and briefed for access 
to APEX-General? 


-OD&E uses two staff type contract 
“couriers o n local runs 
and on overséas 
runs sometimes. They do not 
generally use two couriers on 


Page 42, lines 3, 4, and 5 -Does the prohibition to transmit 
<APEX material via commercial air- 

eraft preclude the use of OD§E 
couriers who now use commercial air- 

craft? Also, how can there be an 
exception to something that is 
prohibited? It appears that the 
wording should be changed. 


45, Section f -~It is recognized that approved 
destruction methods must be used. 
vy But who really approves the methods? 
® The destruction devices themselves 
receive technical approval from 
a different source, and each Agency 
seems to have different criteria. 


Section XV a -Should this paragraph not also 
include specific reference to 
DCID 1/14 requirements? 


Section b, line 6 -The Department of Defense, in. 
DOD 5220.22-M, paragraph 21c 
(Foreign Ownership, Control or 
Influence) requires notification by 
< any investor who as aquired direct 
or indirect beneficial interest 


of five percent or more, not six 


percent 
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Page 57, paragraph 3 


Page 57, paragraph 4 


~How does the "anyone other than 
elected members of the House 

and Senate" jibe with the statement 
on Page 54, paragraph XVI a.l,. 
which states that members of: 
Congress will be granted APEX access 
rovided need-to-known require- 
ments have been established? 


eee 


-Will the Two-Person Rule be used? 
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